Behavioral task
behavioral1
Sample
SV.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SV.exe
Resource
win10v2004-20240802-en
General
-
Target
SV.exe
-
Size
32KB
-
MD5
07cc32d8ffad69ab0bb61e141584d5b0
-
SHA1
20e0991bb6702c9a34888ab823eb0e7dc2ce7b65
-
SHA256
952d26893b8eb7c69ed8dc600d48e5936b4eaf6644aab074bf9d7187f9d7412f
-
SHA512
c5cce79619a7ad3ab61ec2ab0729dcf6600fe5eec7cfa10c2e9ea36152207359709a719ba1b34cd9d9eb61670b9910ee9da06e5894b936b59eeb61ef7326f6de
-
SSDEEP
768:hkm3WDaYaqJOmhS82TXY8m8Fe1LhFye9UHOjhCqSm:hkm3W2qJOc2T1mg4VFf9UHOjXt
Malware Config
Extracted
xworm
3.1
article-stats.gl.at.ply.gg:59951
0GA6iZfaE5P34pI7
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SV.exe
Files
-
SV.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ